A flaw in the Media component of Google Chrome for Windows allows a remote attacker who has already compromised the renderer process to breach the same-origin policy. The vulnerability is an implementation weakness (CWE‑346) that enables a crafted HTML page to read sensitive data from other origins, potentially exposing confidential information. It does not provide a path for arbitrary code execution but undermines web-page isolation and may facilitate data exfiltration from trusted domains.

Google Chrome users on Windows using a version earlier than 151.0.7922.72 are affected. The issue resides in the Chromium-based Chrome browser, specifically the renderer process handling web content.

The CVSS score of 6.5 indicates a medium impact severity, while the EPSS score of less than 1% suggests the current exploitation probability is low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires remote access to an already compromised renderer process and the delivery of a malicious HTML page. The likely attack vector is inferred to be remote web content rather than a local or network-level attack.